Add nixos/configuration.nix

nixos/configuration.nix

@@ -0,0 +1,282 @@
+{ config, pkgs, lib, ... }: {
+
+  imports = [
+    ./hardware-configuration.nix
+    ./networking.nix # generated at runtime by nixos-infect
+    ./modules/smart-ipv6-rotator.nix # ipv6 rotator
+    ./modules/watchdog.nix # anubis watchdog to auto-report to abuseipdb
+  ];
+
+  environment.systemPackages = with pkgs; [
+    (lib.hiPrio pkgs.uutils-coreutils-noprefix)
+    (lib.hiPrio pkgs.uutils-findutils)
+    (lib.hiPrio pkgs.uutils-diffutils)
+    fastfetch # fetch stats!
+    btop
+    python3Minimal
+    git
+    gnuplot
+    ctop
+    starship
+    nftables
+  ];
+
+
+  users.users.nune = {
+    isNormalUser = true;
+    description = "Admin user";
+    createHome = true;
+    extraGroups = [ "wheel" "docker" ];
+    shell = pkgs.zsh;
+    openssh.authorizedKeys.keys = [
+     "ssh-ed25519 XXXXX" # i know its fine to share but im a goober
+    ];
+  };
+
+  programs.zsh = {
+    enable = true;
+    shellAliases = {
+     ne = "sudo nano /etc/nixos/configuration.nix && sudo nixos-rebuild switch";
+     ncg = "sudo nix-collect-garbage";
+    };
+  };
+
+  programs.starship.enable = true;
+
+  # enable sudo; keep password requirement by default
+  security.sudo.enable = true;
+  security.sudo.wheelNeedsPassword = true;
+
+  services.snowflake-proxy = {
+    enable = true;
+    capacity = 50;
+  };
+
+
+  services.yggdrasil = {
+    enable = true;
+    persistentKeys = true;
+
+    settings = {
+      Peers = [
+        "tcp://[2a14:1e00:3:15c::]:65535"
+        "ws://vpn.itrus.su:7994"
+        "tls://23.137.249.65:444"
+        "tcp://[2001:470:1f13:e56::64]:39565"
+        "tcp://51.15.204.214:12345"
+        "tcp://[2a0b:4142:e9e::2]:65535"
+        "tcp://[2a0c:b641:ce0::25d8:c5d6]:65535"
+        "tls://n.ygg.yt:443"
+        "tcp://94.159.110.4:65535"
+        "tcp://[2a0b:4142:ce0::2]:65535"
+        ];
+      Listen = [
+        "tls://0.0.0.0:32000"
+        "tls://[::]:32000"
+      ];
+    };
+  };
+
+  services.i2pd = {
+    enable = true;
+    enableIPv4 = true;
+    port = 35252;
+    address = "91.98.126.143" ;
+    enableIPv6 = true;    # if you don't have IPv6, leave false
+    ifname = "eth0";       # change to your interface
+    bandwidth = 1000;       # limit to 500 KB/s (≈ 4 Mb/s)
+    share = 50;            # allocate 50% of that to transit
+    notransit = false;     # allow transit
+    floodfill = false;     # not acting as floodfill
+    nat = true;            # if behind NAT
+};
+
+  networking.firewall.enable = true;
+  networking.firewall.trustedInterfaces = [ "lo" ]; # loopback
+  networking.firewall.allowedTCPPorts = [ 22 80 443 8080 9091 51413 4001 8013 27905 32000 31311 31312 31313 31314 35252];
+  networking.firewall.allowedUDPPorts = [ 51413 ];  # Transmission uses UDP for DHT/peer discovery
+
+  services.tailscale.enable = true;
+
+  services.smart-ipv6-rotator = {
+    enable = true;
+    ipv6range = "2a01:4f8:c2c:c398::/64";
+    rev = "master";
+    sha256 = "sha256-g2M+obfTGya3bPkNRvpptaBIx0X+94262vEfponycTY=";
+  };
+
+  services.cron = {
+    enable = true;
+    systemCronJobs = [
+      "* * * * * /root/trafficgen.sh >> /var/log/generate_traffic_png.log 2>&1"
+      "0 */6 * * *  docker restart instafix_proxy"
+      "0 */12 * * *  docker system prune -a -f"
+      "0 */1 * * * /bin/bash -lc 'for i in {1..10}; do [ -d /srv/arti$i/cache/dir_blobs ] && find /srv/arti$i/cache/dir_blobs -mindepth 1 -maxdepth 1 -exec rm -rf {} +; done'" # clear redlib cache
+    ];
+  };
+
+  services.caddy = {
+    enable = true;
+    logFormat = ''level INFO'';
+    logDir = ''/var/log/caddy'';
+    virtualHosts."fan.blitzw.in".extraConfig = ''
+      reverse_proxy localhost:10417
+    '';
+    virtualHosts."skylib.blitzw.in".extraConfig = ''
+      reverse_proxy localhost:5081
+    '';
+    virtualHosts."tent.blitzw.in".extraConfig = ''
+      reverse_proxy localhost:5083
+    '';
+    virtualHosts."small.blitzw.in".extraConfig = ''
+      reverse_proxy localhost:5084
+    '';
+    virtualHosts."pinata.blitzw.in".extraConfig = ''
+      reverse_proxy localhost:4100
+    '';
+    virtualHosts."tube.blitzw.in".extraConfig = ''
+      basicauth {
+        guest $2a$12$7GQIZMMRZ69uz4r918I/SuZ/wqTkk1HFaSC3jeQs.GTPWicekcmtC
+      }
+        reverse_proxy 100.76.137.52:33020
+    '';
+    virtualHosts."hooligan.srv.blitzw.in".extraConfig = ''
+      root * /srv/landing
+      file_server
+    '';
+    virtualHosts."mirage.blitzw.in".extraConfig= ''
+      reverse_proxy localhost:35200 {
+                header_up X-Real-Ip {remote_host}
+                header_up X-Http-Version {http.request.proto}
+                header_up X-Forwarded-Host {host}
+                header_up Host {host}
+                header_up Referer {>Referer}
+     }
+    '';
+    virtualHosts."priviblur.blitzw.in".extraConfig= ''
+      reverse_proxy localhost:24215 {
+                header_up X-Real-Ip {remote_host}
+                header_up X-Http-Version {http.request.proto}
+                header_up X-Forwarded-Host {host}
+                header_up Host {host}
+                header_up Referer {>Referer}
+     }
+    '';
+    virtualHosts."genius.blitzw.in".extraConfig=''
+      reverse_proxy localhost:2006 {
+                header_up X-Real-Ip {remote_host}
+                header_up X-Http-Version {http.request.proto}
+                header_up X-Forwarded-Host {host}
+                    header_up Host {host}
+     }
+    '';
+    virtualHosts."pin.blitzw.in".extraConfig= ''
+      reverse_proxy localhost:6600
+    '';
+    virtualHosts."search.blitzw.in".extraConfig = ''
+      reverse_proxy localhost:24999
+    '';
+    virtualHosts."wikimore.blitzw.in".extraConfig = ''
+      reverse_proxy localhost:8109
+    '';
+    virtualHosts."twitch.blitzw.in".extraConfig = ''
+      reverse_proxy localhost:5600
+    '';
+    virtualHosts."moz.blitzw.in".extraConfig = ''
+      reverse_proxy localhost:3012
+    '';
+    virtualHosts."rl.blitzw.in".extraConfig = ''
+      respond "301 Moved Permanently" 301
+    '';
+    virtualHosts."bilder.blitzw.in".extraConfig = ''
+      basicauth {
+        guest $2a$12$7GQIZMMRZ69uz4r918I/SuZ/wqTkk1HFaSC3jeQs.GTPWicekcmtC
+      }
+      reverse_proxy localhost:4243
+    '';
+    virtualHosts."sc.blitzw.in".extraConfig = ''
+      basicauth {
+        guest $2a$08$n0D.stczLfrMFJLleu7i5uAxpmwEs.EvjTlitmEAFvopi5xOqzK4y
+      }
+      reverse_proxy localhost:4665
+    '';
+    virtualHosts."yt2009.blitzw.in".extraConfig = ''
+      basicauth {
+        guest $2a$12$o/yxcMasmTKgCJGVmUNZ4OYYDHL4iPOeMgiZvUZrnoxtTWTnOBDke
+      }
+      reverse_proxy localhost:2009
+    '';
+    virtualHosts."ladder.blitzw.in".extraConfig = ''
+      reverse_proxy localhost:28000
+    '';
+    virtualHosts."lens.blitzw.in".extraConfig = ''
+      reverse_proxy localhost:4664
+    '';
+    virtualHosts."lf.blitzw.in".extraConfig = ''
+      basicauth {
+        lf $2a$12$HBepdgYKEdIEJ.bn0F4xUOHWciPK2mbBEAo2C3XDVD03ljnUmmTz6
+      }
+      reverse_proxy localhost:46000
+    '';
+    virtualHosts."test.blitzw.in".extraConfig = ''
+      reverse_proxy localhost:28001
+    '';
+    virtualHosts."fxstagram.com".extraConfig = ''
+        root * /srv/instafix
+
+        @root path /
+        handle @root {
+                file_server
+        }
+
+        @traffic path /traffic.png
+        handle @traffic {
+                file_server
+        }
+
+        handle {
+                reverse_proxy localhost:3000
+        }
+    '';
+    virtualHosts."fxstagram.com".serverAliases = [ "www.fxstagram.com" "1.fxstagram.com" "2.fxstagram.com" "3.fxstagram.com" ];
+  };
+
+  # ... your other config ...
+
+services.journald.extraConfig = ''
+  # keep journals on disk (persistent) instead of only in /run
+  Storage=persistent
+
+  # keep more log data before rotation / vacuuming
+  # adjust these to taste (units: K M G)
+  RuntimeMaxUse=1G
+  RuntimeMaxFileSize=100M
+
+  SystemMaxUse=4G
+  SystemMaxFileSize=200M
+  SystemMaxFiles=100
+
+  # optionally keep logs for up to a time limit (if your systemd supports it)
+  # MaxRetentionSec=90d
+'';
+
+# ensure journals are flushed from /run to /var on shutdown so persistence works
+systemd.services.systemd-journal-flush.enable = true;
+
+  virtualisation.docker.enable = true;
+  boot.tmp.cleanOnBoot = true;
+  zramSwap.enable = true;
+  networking.hostName = "hooligan";
+  networking.domain = "";
+  services.openssh = {
+    enable = true;
+    permitRootLogin = "no";            # disallow root SSH
+    passwordAuthentication = false;    # disable password auth for SSH entirely
+    challengeResponseAuthentication = false;
+    extraConfig = ''
+      AllowUsers nune
+    '';
+  };
+  users.users.root.openssh.authorizedKeys.keys = [ ];
+  system.stateVersion = "23.11";
+}